Privacy policy
Last updated 25 October 2026
This policy explains what personal information XAGOe collects when you visit xagoe.com, join early access, or use the XAGOe app at app.xagoe.com and your company's workspace address (for example yourcompany.xagoe.com), what we do with it, and the choices you have.
XAGOe ("we", "us") runs these services. If you have a question about this policy or your information, email admin@xagoe.com.
What we collect
We collect only what we need to run the service:
- Account details: your name and email address, and the date you last signed in.
- Sign-in details: when you sign in with Google, Microsoft or LinkedIn, we receive your name, your email address, whether that provider has verified the email, and an account identifier from that provider. We use them only to create your XAGOe account and sign you in. We don't receive your password, and we don't read your contacts, posts, connections or anything else from those accounts.
- Workspace content: the companies, apps, lists, entries, pages, comments and settings that you and your colleagues add to a workspace.
- Activity records: an audit log of important actions in a workspace (for example who changed a permission or created an app, and when), and notifications sent to you inside the app.
- Early access and updates: if you fill in the early-access form or subscribe to updates on xagoe.com, your email address, and optionally your company and what you'd like to build, plus the country your request came from.
- Technical information: your IP address and browser details as part of normal web requests. We use the IP address to stop repeated sign-in and sign-up attempts, and our hosting provider keeps short-lived request logs for security and troubleshooting.
How we use it
- To provide the service: create your account and workspace, sign you in, show you what your role allows, and send sign-in links, invitations and notifications you ask for.
- To keep it safe: limit repeated attempts, record important changes in the audit log, and investigate problems.
- To build apps with AI when you ask: when you describe an app or ask for a change in the app builder, we send your description and the outline of the draft app (its lists, details and steps) to our AI provider to produce the draft. We don't send the entries in your workspace.
- To reply to you: if you joined early access or contacted us, to get back to you about XAGOe.
- We don't sell your personal information, we don't use it for advertising, and we don't use your workspace content to train AI models.
Why we're allowed to use it
Where data protection laws such as the GDPR or Vietnam's Decree 13/2023 apply, we rely on: the contract with you or your company to provide the service; our legitimate interest in keeping the service secure and working; and your consent where we ask for it (for example product updates, which you can unsubscribe from at any time).
Your company's workspace
A workspace belongs to the company that created it. That company decides who can join, what each person can see, and what is stored there, and its administrators can see the workspace's audit log. For the content in a workspace, we act on the company's behalf. If you have a question about information your employer keeps about you in XAGOe, ask them first; we'll help them answer.
Where it's stored and for how long
Our providers process data in data centres in several countries, which may be outside the country where you live. We rely on their contractual safeguards for these transfers.
We keep account details and workspace content for as long as the account or workspace exists. Sign-in links expire after 15 minutes and sessions after 30 days. Records used to limit repeated attempts are deleted after 7 days, and request logs are kept by Cloudflare for a few days. Early-access details are kept until you ask us to remove them. When a workspace or account is deleted, we remove its information, except where we must keep something by law.
How we protect it
All traffic is encrypted (HTTPS). Sign-in links and session tokens are random and we store only a scrambled (hashed) form of them. Each company's workspace is kept separate, and every read and change is checked against the person's permissions on our servers. Details marked as sensitive, such as salaries, are only sent to people allowed to see them. No system is perfectly secure, so if we learn of a breach that affects you, we'll tell you and the relevant authorities as the law requires.
Your choices and rights
You can ask us to show you, correct, export or delete your personal information, or object to how we use it, by emailing admin@xagoe.com. You can unsubscribe from product updates with the link in any update email. If you signed in with Google, Microsoft or LinkedIn, you can also remove XAGOe's access in that account's settings at any time. If you're not happy with our answer, you can complain to your local data protection authority.
Children
XAGOe is a tool for businesses and isn't meant for anyone under 16. We don't knowingly collect information about children.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change matters, we'll also tell you in the app or by email before it takes effect.
Contact
Questions or requests about your privacy: admin@xagoe.com.